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DETAILED ACTION 
Response to Amendment 

1 . The Applicant's amendment, filed 23 July 2007, has been received, entered into 
the record, and respectfully and fully considered. 

2. As a result of the amendment claim 31 and 34-35 have been amended. Claims 
1-7, 16-22, 31-37 and 46-52 are now presented for examination. 

3. Any objection/rejection not repeated below has been withdrawn due to 
Applicant's amendment. 

Election/Restrictions 

4. Applicant's election with traverse of Group I (claims 1-7, 16-22, 31-37 and 46-52) 
in the reply filed on 25 January 2007 is acknowledged. The traversal is on the 
ground(s) that subcombination characterization in the action is incorrect and failed to 
recognize the proper relationship between the claims. 

This is not found persuasive because: 

On page 2 of the Applicant's argument, the Applicant argues "The Group II 
claims are directed at a method for making such an obfuscated application program" 
and on page 3 of the Applicant's argument, the Applicant argues, "The group II claims 
recited a method of making such an encoded opcode and group III claims at the 
product. Thus the subcombination characterization in the action is incorrect... which is 
required by the Rules... product, process of making, and process of using...". 
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The examiner respectfully responds that, group II claims recite a method of 
"creating an opcode value encoding scheme" (Please see pages 69, 73, 77 and 80 
of the original claims). Thus, contrary to the Applicant's argument, Group II claims are 
not a method of making such an encoded opcode and not a method of method for 
making such an obfuscated application program. 

Additionally, the examiner respectfully points out, group III claims recite a 
memory storing a data structure, which includes information used by the application 
program execute an obfuscated application program (Please see page 82 of the original 
claims). Therefore, contrary to the Applicant's argument, Group II claims are not a 
product. 

Therefore, the process of making and product are not presented in the Group II 
and Group III claims as the Applicant argues. The subcombination characterization in 
the action is correct and claims 8-15, 23-30, 38-45, 53-60 and 61-63 are withdrawn from 
consideration. 

The requirement is still deemed proper and is therefore made FINAL. 

Specification 

5. The disclosure is objected to because of on page 1 8, paragraph [001 5], "The 
process can be implemented as instructions executed by such hardware, hardware 
alone, or any combination thereof. The software... readable by a machine". It appears 
to the examiner that the sentence is contradicted to itself. If only hardware alone, where 
is any combination thereof. The examiner assumes the Applicant meant "The process 
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can be implemented as instructions executed by such software, hardware alone, or any 
combination thereof... ." Appropriate correction is required. 

On page 34 of the remark, the Applicant explained argues "...hardware that does 
not reply upon executing code, e.g., an ASIC". What is ASIC? Please clarify. Further, 
ASIC is not supported in the original disclosure. Therefore, the objection is maintained. 

6. On page 7 of the remark, the Applicant requests to "replace paragraph [0040] 
with the following rewritten paragraph [0040]". However, in the replacement paragraph 
[0040], the Applicant discloses "... in virtual machine 491 and a second portion 484 in 
smart card 425. .First portion 484 uses secret 425... Second portion 482. It appears 
to the examiner that the Applicant confused himself on the first portion and second 
portion. Please correct. 

7. This is not intended to be a complete list of objections to the replacement 
specification. Applicant is required to review and correct the specifications to 
place them in compliance. 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
the basis for the rejections under this section made in this Office action: 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 



8. 

form 
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9. Claims 1-2, 4, 16-17, 19, 31-32, 34 and 46-47, 49 are rejected under 35 
U.S.C. 102(e) as being anticipated by Zeman et al. (U.S. Pub. No. 2004/0003264). 

As per claims 1 and 31, Zeman et al. discloses a method/apparatus for 
executing an obfuscated application program, the method/apparatus comprising: 

receiving an obfuscated application program, said obfuscated 
application program comprising at least one instruction opcode value encoded 
using one of a plurality of instruction set opcode value encoding schemes ("Sometime 
before an obfuscated function is called, it must be deobfuscated..." - e.g. par. [0082], 
"At step 902, the deobfuscation process is triggered. Deobfuscation is triggered at 
some point in time before the function is called" - e.g. par. [0083], par. [0073]- [0077] 
and Fig. 8); 

determining a dispatch table associated with said application program, said 
dispatch table corresponding to said one of a plurality of instruction set 
opcode value encoding schemes ("The original bytes, and their offsets into the 
function, are saved in a table so that the function can later be "de-obfuscated" by 
restoring they bytes to their original values" - e.g. par. [0006], "At step 810, a healing 
table (e.g., healing table 600, shown in Fig. 6) is created to aid in the deobfuscation of 
code prior to its execution... At step 812, the healing table is added to the 
executable..." - e.g. par. [0078] - [0079]); and 

executing said application program using said associated dispatch table ("The 
deobfuscation routine consults the table and restores the replaced bytes in the function 
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to their original values" - e.g. par. [0008] , "...This pre-obfuscation value is determined, 
preferably, by looking up the value on healing table 600... At some subsequent point, 
the function is called (step 912), and execution of the function proceeds (step 914) - 
e.g. par. [0084] and fig. 9. Please note healing table 600 corresponds to Applicant's 
dispatch table). 

As per claims 2 and 32, Zeman et al discloses a method/apparatus as applied 
above in claims 1 and 31 above. Zeman et al. further discloses wherein said 
determining comprises generating said dispatch table in response to said receiving 
("While step 810 is shown below step 808 in Fig. 8, it should be noted that the healing 
table does not have to be created subsequent to the replacement of bytes in the 
original code. In fact, the healing table is preferably created while the bytes are being 
replaced). 

As per claims 16-17, Zeman et al. discloses the claimed method of steps as 
applied above in claims 1-2. Therefore, Zeman et al. discloses the claimed program of 
instructions embodied in a program storage device for carrying out the method of 
steps. 

As per claims 46-47, they are rejected using the same rationale as rejecting 
claims 31-32 above. 

As per claims 4 and 34, Zeman et al. discloses a method/apparatus for 
executing ah obfuscated application program, the method/apparatus comprising: 



Application/Control Number: 10/672,700 Page 7 

Art Unit: 2135 

receiving an obfuscated application program, said obfuscated application 
program comprising at least one instruction opcode value encoded . 
using one of a plurality of non-standard instruction set opcode value encoding 
schemes ("In a preferred embodiment, healing table 600 is stored... in a "scrambled" 
form... .For example, healing table 600 can be XOR'd with a known value. This XOR 
technique allows the content of healing table 600 to be recovered easily, while making 
its presence within executable 10(1) somewhat more obscure that it would be if healing 
table 600 were stored in the clear" - e.g. par. [0071] and fig. 7. Please note 
"scrambled" healing table corresponds to Applicant's non-standard instruction set 
opcode value); 

determining an instruction set opcode value encoding scheme 
associated with said obfuscated application program ("The original bytes, and their 
offsets into the function, are saved in a table so that the function can later be "de- 
obfuscated" by restoring they bytes to their original values" - e.g. par. [0006], "At step 
810, a healing table (e.g., healing table 600, shown in Fig. 6) is created to aid in the 
deobfuscation of code prior to its execution... At step 812, the healing table is. added to 
the executable..." - e.g. par. [0078] - [0079]); 

rewriting said application program using a standard opcode value encoding 
scheme if said received application program is not encoded using said standard 
opcode value encoding scheme ("An example of an executable rewritten according to 
step 812 is discussed above in connection with Fig. 7" - e.g. par. [0079]; and 
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executing said application program using a dispatch table associated with said 
standard opcode value encoding scheme ("The deobfuscation routine consults the 
table and restores the replaced bytes in the function to their original values" - e.g. par. 
[0008] , "...This pre-obfuscation value is determined, preferably, by looking up the 
value on healing table 600... At some subsequent point, the function is called (step 
912), and execution of the function proceeds (step 914) - e.g. par. [0084] and fig. 9. 
Please note healing table 600 corresponds to Applicant's dispatch table). 

As per claim 19, Zeman et al. discloses the claimed method of steps as applied 
above in claim 4. Therefore, Zeman et al. discloses the claimed program of 
instructions embodied in a program storage device for carrying out the method of 
steps. 

As per claim 49, it is rejected using the same rationale as rejecting claim 34 

above. 

10. Claims 5-6, 20-21, 35-36 and 50-51 are rejected under 35 U.S.C. 102(e) as 
being anticipated by Kiddy (U.S. Patent No. 6,694,435) 

As per claims 5 and 35, Granger et al. discloses a method/apparatus for 
application program obfuscation, the method/apparatus comprising: 

reading an application program comprising code (e.g. col. 5, lines 5-25); 
transforming said application program code into transformed application program 
code that uses one of a plurality of opcode value encoding schemes of a dispatch table 
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associated with said application program (e.g. col. 5, lines 45-67 and col. 6, lines 1-47 
); and 

sending said transformed application program code (e.g. col. 7, lines 13-30). 

As per claims 6 and 36, Kiddy discloses a method/apparatus as applied above 
in claims 5 and 35. Kiddy further discloses comprising receiving an application 
program request from a user device, said transforming occurring in response to said 
receiving (e.g. col. 6, lines 15-65 and col. 7, lines 13-30). 

As per claims 20-21, Kiddy discloses the claimed method of steps as applied 
above in claims 5-6. Therefore, Kiddy discloses the claimed program of instructions 
embodied in a program storage device for carrying out the method of steps. 

As per claims 50-51, they are rejected using the same rationale as rejecting 
claims 35-36 above. 

Claim Rejections - 35 USC §103 

11. The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1 , 148 
USPQ 459 (1966), that are applied for establishing a background for determining 
obviousness under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 
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4. Considering objective evidence present in the application indicating 
obviousness or nonobviousness. 

12. This application currently names joint inventors. In considering patentability of 
the claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of 
the various claims was commonly owned at the time any inventions covered therein 
were made absent any evidence to the contrary. Applicant is advised of the obligation 
under 37 CFR 1.56 to point out the inventor and invention dates of each claim that was 
not commonly owned at the time a later invention was made in order for the examiner to 
consider the applicability of 35 U.S.C. 103(c) and potential 35 U.S.C. 102(e), (f) or (g) 
prior art under 35 U.S.C. 103(a). 

13. Claims 3, 18, 33 and 48 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Zeman et al (U.S. Pub. No. 2004/0003264) 

As per claims 3 and 33, Zeman et al. discloses a method/apparatus as applied 
above in claims 1 and 31 above. Zeman et al. does not expressly disclose wherein 
said determining comprises selecting a dispatch table from a plurality of dispatch tables 
in response to said receiving, said plurality of dispatch tables stored in a memory. 

The examiner takes official notice that selecting a table from a plurality of tables 
is common knowledge in the art at the time of the invention. 

It would have been obvious to a person with ordinary skill in the art at the time of 
the invention to combine the above common knowledge into Zeman et al.'s 
method/apparatus. 

The motivation of doing so would have been to select the right table in order to 
"consults the table and restores the replaced bytes in the function to their original 
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values" since "the table contains the original byte values", as disclosed by Zeman etal. 
(par. [0008]) 

As per claims 18, Zeman et al. discloses the claimed method of steps as applied 
above in claims 3. Therefore, Zeman et al. discloses the claimed program of 
instructions embodied in a program storage device for carrying out the method of steps. 

As per claims 48, it is rejected using the same rationale as rejecting claim 33 

above. 

14. Claims 7, 22, 37 and 52 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Kiddy as applied to claims 5 and 35 above, and further in view of 
Drake (U.S. Patent No. 6,006,328). 

As per claims 7 and 37, Kiddy discloses a method/apparatus as applied above 
in claims 5 and 35. Kiddy does not expressly disclose using encryption. 
However, Drake discloses after said creating, applying a cryptographic process to said 
obfuscated application program together with a cryptographic key to create an 
encrypted obfuscated application program; and said sending comprises sending said 
encrypted obfuscated application program (e.g. fig. 6, col. 4, lines 40-67, col. 5, lines 1- 
35, col. 16, lines 1-67). 

It would have been obvious to one with ordinary skill in the art at the time of the 
invention to incorporate encryption with the method/apparatus of Kiddy. 

The motivation of doing so would have been to provide further security to the 
application (Drake, summary). 
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As per claim 22, Kiddy-Drake disclose the claimed method of steps as applied 
above in claim 7. Therefore, Kiddy-Drake disclose the claimed program of instructions 
embodied in a program storage device for carrying out the method of steps. 

As per claim 52, it is rejected using the same rationale as rejecting claim 37 
above. 

Double Patenting 

1 5. Claims 1-7, 16-22, 31-37 and 46-52 are provisionally rejected under the judicially 
created doctrine of nonstatutory obviousness-type double patenting as being 
unpatentable over claims 1-48 of copending Application No. 10/672,183. Although the 
conflicting claims are not identical, they are not patentably distinct from each other 
because the subject matter claimed in the instant application is also claimed in the 
referenced copending application. 

16. This is a provisional obviousness-type double patenting rejection because the 
conflicting claims have not in fact been patented. 

17. The subject matter claimed in the instant application is fully claimed in the 
referenced copending application and would be covered by any patent granted on that 
copending application since the referenced copending application and the instant 
application are claiming common subject matter, as follows: 

. The instant application claims a method for executing an obfuscated application 
program, the method comprising: receiving an obfuscated application program, said 
obfuscated application program comprising at least one instruction opcode value 
encoded using one of a plurality of instruction set opcode value encoding schemes; 
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determining a dispatch table associated with said application program, said 
dispatch table corresponding to said one of a plurality of instruction set 
opcode value encoding schemes; and executing said application program using 
said associated dispatch table (Claim 1). 

The copending application claims a method for executing an obfuscated 
application program, the method comprising: receiving an obfuscated application 
program, said obfuscated application program comprising at least one instruction 
opcode value encoded using one of a plurality of instruction set opcode value encoding 
schemes; receiving an application program instruction corresponding to a current 
instruction counter value; selecting an instruction dispatch table based at 
least in part on said current instruction counter value; and executing said 
application program instruction using said selected instruction dispatch table (Claim 1). 
18. Claims 1-7, 16-22, 31-37 and 46-52 of the instant application are envisioned by 
copending Application No. 1 0/672, 183's claims 1-48 in that claims 1-48 of the 
copending application contain all the limitations of claims 1-7, 16-22, 31-37 and 46-52 
of the instant application therefore are not patently distinct from the copending 
application claims and as such are unpatentable for obvious-type double patenting 
because it would have been obvious to do the obfuscation in copending application 
conditional to some event and/or using a table to select/permute instructions. 
19. Claims 1-7, 16-22, 31-37 and 46-52 are provisionally rejected under the judicially 
created doctrine of nonstatutory obviousness-type double patenting as being 
unpatentable over claims 1-52 of copending Application No. 10/673,021 . Although the 
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conflicting claims are not identical, they are not patentably distinct from each other 
because the subject matter claimed in the instant application is also claimed in the 
referenced copending application. 

20. This is a provisional obviousness-type double patenting rejection because the 
conflicting claims have not in fact been patented. 

21 . The subject matter claimed in the instant application is fully claimed in the 
referenced copending application and would be covered by any patent granted on that 
copending application since the referenced copending application and the instant 
application are claiming common subject matter 

22. Claims 1-7, 16-22, 31-37 and 46-52 of the instant application are envisioned by 
copending Application No. 10/673,021 's claims 1-48 in that claims 1-52 of the 
copending application contain all the limitations of claims 1-7, 16-22, 31-37 and 46-52 of 
the instant application therefore are not patently distinct from the copending application 
claims and as such are unpatentable for obvious-type double patenting because it 
would have been obvious to do the obfuscation in copending application conditional to 
some event and/or using a table to select/permute instructions. 

Response to Arguments 

23. Applicant's argument filed on 23 July, 2007 have been respectfully and fully 
considered but they are not persuasive. 

> Applicant argues: 
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. "Zeman fails to teach that the opcode instruction value was "encoded using one 
of a plurality of instruction set opcode value encoding schemes" (see page 38, Applicant 
Argument/Remarks). 

Examiner maintains: 

First, the examiner acknowledges that the Applicant agrees with the examiner 
that Zeman teaches "at least one instruction opcode value (see page 38, Applicant 
Argument/Remarks) 

Second, Zeman teaches in par. [0073]-[0077] "...replacing randomly selected 
bytes with one-byte instructions. Thus, setp 804 preferably comprises creating a list 
of one-byte instructions that can be used to replace the randomly selected bytes.. .At 
step 808, the bytes selected for change at step 806 are replaced with new bytes... these 
new bytes are preferably taken from the list of one-byte instructions for the platform 
on which the code will operate. Typically, these bytes will be chosen from the list 
created at step 804. 

Therefore, Zeman discloses encoded using one of a plurality of instruction set 
opcode value encoding schemes. 

> Applicant argues: 

"Kiddy fails to discloses a dispatch table" (page 41 of the remark). 
Examiner maintains: 
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Kiddy teaches in col. 6, lines 24-47, Tig. 7 shows a detailed example of 
interleaving parts from two streams into an obfuscated stream... .Stream 720 
is a stream of byte codes for the purpose of obfuscation. Stream 720 may be 
a stream of byte codes... of the same class... another class... Stream 720 
can be broken into parts 722, 724, 726 and 728...". 
Therefore, Kiddy discloses a dispatch table. 

> Applicant argues: 

"..Claims 2, 17, 32 and 47. ..The rejection failed to cite any teaching that ...is 
performed in response to receiving an obfuscated application program as 
recited in these claims", (remark page 39), the examiner respectfully 
disagree. 

First, claims 2, 17, 32 and 47 are either dependent or similar claims of 
claims 1 and 5. Since the arguments for the independent claims 1 and 5 are 
traversed, therefore, claims 2, 17, 32 and 47 are also not allowable. 

Second, "is performed in response to receiving an obfuscated application 
program" is disclosed in par. [0078] of Zeman ("While step 810 is shown below 
step 808 in Fig. 8, it should be noted that the healing table does not have to 
be created subsequent to the replacement of bytes in the original code. In 
fact, the healing table is preferably created while the bytes are being 
replaced); 
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> Applicant argues: 

"Claims 6, 21 , 36 and 51 ...distinguishes over Kiddy at least for the same 
reason as the independent claim from which it depends" (remark page 41 ), 
the examiner respectfully disagree. 

Since the arguments for the independent claim 5 is traversed and claims 
6, 21 and 36 and 51 are dependent/similar claims, they are also not 
allowable. 

> Applicant argues: 

"Applicant respectfully traverses the use of Official knowledge ...claim 3 
does not recite simply a table, but rather a specific table...", the examiner 
respectfully disagrees. 

First, claims 3, 7, 18, 22, 33, 37, 48 and 52 are either dependent or 
similar claims of claims 1 and 5. Since the arguments for the independent 
claims 1 and 5 are traversed, therefore, claims 3, 7, 18, 22, 33, 37, 48 and 
52 are also not allowable. 

Second, the Applicant is respectfully reminded that Zeman 
discloses a dispatch table in claim 1 . Therefore, the official notice is 
appropriate in applied to selecting a dispatch table from a plurality of 
dispatch table. The claims would have been obvious because selecting a 
dispatch table from a plurality of dispatch table is particular known 
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technique and it was recognized as part of the ordinary capabilities of one 
skill in the art. Please see KSR, 82 USPQ2d at 1397. 
> Applicant's argument on traversing nonstatutory obviousness type double 
patenting rejection in view of claims 1-48 of co-pending application 
10/672,183 and in view of claims in the co-pending application 10/673,021 
is acknowledged, it is not persuasive at this time. 

The limitations "using a current instruction counter value" in the co- 
pending application are obvious to a person with ordinary skill in the art in 
comparison with the current application. Further, the limitation "a dispatch 
table" in the instant application is obvious to a person with ordinary skill in 
the art in comparison with the co-pending application 10/673,021. 
Although the conflicting claims are not identical, they are not patentably 
distinct from each other and encompass the same subject matter. 

Therefore, due to the above reasons, the examiner maintains the 
double patenting rejection. 

Conclusion 

24. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 . 1 36(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
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shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 
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Contact Information 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to April Y. Shan whose telephone number is (571 ) 270- 
1014. The examiner can normally be reached on Monday - Friday, 8:00 a.m. - 5:00 
p.m., EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Y. Vu can be reached on (571 ) 272-3859. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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